CVE-2026-89723: Linux Kernel Buffer Overflow Vulnerability

CVE-2026-89723 Overview

CVE-2026-89723 is a slab-out-of-bounds access vulnerability in the Linux kernel's nilfs2 filesystem. The flaw resides in the nilfs_direct_propagate() function and was surfaced by Kernel Address Sanitizer (KASAN) during testing. After a file truncation, an intermediate B-tree node block remains in the B-tree node cache in a dirty state. The log writer later processes this stale node as if it were a direct mapping entry, triggering out-of-bounds memory access. A local, authenticated user with the ability to perform filesystem operations on a nilfs2 volume can trigger memory corruption in kernel space.

Critical Impact
Local users can trigger kernel memory corruption in the nilfs2 filesystem, leading to denial of service or potential privilege escalation.

Affected Products

Linux kernel builds with the nilfs2 filesystem compiled and available
Distributions shipping affected upstream kernel versions prior to the patched stable releases
Systems mounting untrusted nilfs2 volumes or exposing nilfs2 to unprivileged users

Discovery Timeline

Vulnerability reported by Shuangpeng Bai via KASAN testing
2026-09-11 - CVE-2026-89723 published to NVD
2026-09-14 - Last updated in NVD database

Technical Details for CVE-2026-89723

Vulnerability Analysis

The nilfs2 filesystem organizes file data through B-tree mappings that can collapse into direct mappings when the tree becomes small enough. During truncation, the code path that converts a B-tree mapping into a direct mapping fails to delete an intermediate node block referenced by the root node. That orphaned node block persists in the B-tree node cache marked dirty. When the log writer scans dirty blocks during segment construction, it detects the residual node and invokes nilfs_direct_propagate() on it. That function is only designed to process data blocks under a direct mapping, so processing a B-tree node causes indexing beyond the allocated slab object. The resulting slab-out-of-bounds access corrupts adjacent kernel memory.

Root Cause

The root cause is incomplete cleanup during the B-tree to direct mapping conversion. B-tree nodes in the cache are keyed by virtual block numbers whose logical keys typically exceed the range that direct mapping expects. Leaving the intermediate node behind creates a type-confusion condition between B-tree node blocks and direct mapping data blocks. The upstream fix introduces a nilfs_btree_discard() operation and adds a deform flag to the bop_delete interface. The flag signals that the deletion is part of a mapping transformation, allowing the B-tree implementation to discard residual node structures.

Attack Vector

Exploitation requires local access with permission to create, write, and truncate files on a mounted nilfs2 filesystem. An attacker crafts a file large enough to require a multi-level B-tree, then truncates it so the tree collapses into a direct mapping. Subsequent filesystem activity that triggers the log writer causes nilfs_direct_propagate() to operate on the stale node, producing out-of-bounds memory access in kernel context.

No public proof-of-concept exploit is currently referenced in the CVE data. Technical details are available in the upstream kernel commits, including Kernel Git Commit 28362e8 and Kernel Git Commit bf49e6f.

Detection Methods for CVE-2026-89723

Indicators of Compromise

KASAN reports referencing nilfs_direct_propagate in kernel logs (dmesg, /var/log/kern.log)
Unexpected kernel oops, panics, or filesystem lockups on hosts mounting nilfs2 volumes
Repeated truncation workloads against nilfs2 from non-administrative users preceding kernel faults

Detection Strategies

Monitor kernel ring buffers for slab-out-of-bounds signatures involving nilfs2 symbols
Audit which systems have the nilfs2 module loaded using lsmod | grep nilfs2 and inventory mount points from /proc/mounts
Correlate unprivileged filesystem syscall telemetry (create, write, truncate) with kernel error events

Monitoring Recommendations

Forward kernel logs to a centralized logging or SIEM platform for anomaly detection on filesystem panics
Establish baselines for nilfs2 usage and alert on new mounts or module loads in production environments
Track kernel package versions across the fleet to identify hosts that remain on vulnerable builds

How to Mitigate CVE-2026-89723

Immediate Actions Required

Apply the patched Linux kernel updates from your distribution vendor as soon as they are available
If nilfs2 is not required, unload the module and blocklist it to eliminate the attack surface
Restrict local shell access on multi-tenant systems and limit which users can mount or interact with nilfs2 volumes

Patch Information

The upstream fix adds a nilfs_btree_discard() call to remove the residual intermediate node during B-tree to direct mapping conversion and introduces a deform flag on bop_delete. The patch is distributed across multiple stable branches. See Kernel Git Commit 28362e8, Kernel Git Commit 39005fd, Kernel Git Commit 448636c, Kernel Git Commit 45662de, Kernel Git Commit 4a1bb1f, Kernel Git Commit 5d3783c, Kernel Git Commit b313edf, and Kernel Git Commit bf49e6f.

Workarounds

Blocklist the nilfs2 kernel module on systems that do not require it
Deny mount privileges for nilfs2 filesystems to unprivileged users through udev and mount policy
Disable automatic filesystem detection and mounting for removable media on shared hosts

bash

# Blocklist the nilfs2 module to prevent load
echo 'blacklist nilfs2' | sudo tee /etc/modprobe.d/blacklist-nilfs2.conf
echo 'install nilfs2 /bin/true' | sudo tee -a /etc/modprobe.d/blacklist-nilfs2.conf
sudo update-initramfs -u

# Verify the module is not loaded
lsmod | grep nilfs2